Usage
pkguard scan [path] [options]
alias
pkguard audit [path]
Arguments
path (optional)
Directory to scan (defaults to the current directory)
Options
--preset <relaxed|standard|strict>
Policy preset
--jobs <jobs>
Max concurrent audits (defaults to min(cpus*2, 16))
--format <human|json>
Output format
--refresh
Ignore cached advisory results for this run and re-fetch
--no-cache
Disable the advisory cache entirely (no reads, no writes)
-q, --quiet
Suppress progress output
--fix
Write the safe settings into each manager's config file
--force
Allow `--fix` on a dirty git tree
--dry-run
With `--fix`, show the changes and write nothing
--no-audit
Skip every live package-manager audit (offline)
-h, --help
Print help
Exit codes
0
Every project passed.
1
Policy failure: settings drift or an advisory at or above the preset's gate.
2
Incomplete run: a missing binary, an audit subprocess died, or no projects were found.
In CI, pair --format json with your archive step. The document carries schemaVersion 2 and the exit code.
Agentic checks
Reported by default. Turn off with [agentic] enabled = false in config. These codes are the finding-code contract. --fix writes settings only. It does not apply agentic findings.
cache.path-committed
A project file pins storeDir, cache, cacheFolder, or install.cache.dir.
Shared caches belong in user config. A committed home path breaks CI and other agents. Apply only unsets an in-repo path — it never writes ~/…/store.
agentic.cache-disabled
yarn enableGlobalCache is false.
Leave enableGlobalCache true unless the team vendors .yarn/cache (Zero-Installs).
overrides.present
overrides, resolutions, or pnpm workspace overrides force a version the manifest does not show.
The next agent will copy this instead of upgrading. Presence is the warning; apply never deletes a pin.
overrides.legacy-location
package.json#pnpm.overrides on pnpm 11 or later.
pnpm 11 ignores package.json#pnpm. Apply can move the map to pnpm-workspace.yaml only.
layout.shamefully-hoist
pnpm shamefullyHoist is true, or publicHoistPattern contains *.
Makes require() succeed for undeclared deps. The next isolated install breaks.
layout.pnp
yarn or pnpm nodeLinker is pnp (yarn's default).
Most agents assume node_modules and run node, not yarn node. Apply to node-modules is opt-in because it changes the team layout.